Closed LucioDonda closed 1 week ago
New resulting JSON:
{
"data": {
"@timestamp": "2024/11/15 18:05:48",
"package": {
"architecture": " ",
"description": " ",
"installed": " ",
"name": "ufoLib2",
"path": "/usr/lib/python3/dist-packages/ufoLib2-0.16.0.dist-info/METADATA",
"size": 0,
"type": "pypi",
"version": "0.16.0"
}
},
"id": "aW52ZW50b3J5OnBhY2thZ2VzOnVmb0xpYjI6MC4xNi4wOiA6cHlwaTovdXNyL2xpYi9weXRob24zL2Rpc3QtcGFja2FnZXMvdWZvTGliMi0wLjE2LjAuZGlzdC1pbmZvL01FVEFEQVRB",
"operation": "create",
"type": "packages"
}
Decoding:
Description
Get the original package inventory fields and renamed them in order to comply with the ECS mapping.
Logs/Alerts example
64 base decoding:
Tests
Running agent against mock server, received propper events with only the packages inventory item enabled.